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The  military’s  greatest  strategic  asset  is  its  personnel.  Key  to  individual  quality  of 
life  and  unit  performance  is  the  relationship  between  service  members  (SM)  and  their 
leaders.  Leaders  need  to  know  as  much  as  possible  about  their  troops.  Meanwhile 
SMs  often  want  to  keep  medical  information  private.  Privacy  between  patients  and 
healthcare  providers  advances  important  societal  objectives.  Compelling  reasons  justify 
privacy,  particularly  in  a  military  context  where  the  negative  stigma  of  seeking 
behavioral  health  services  is  acute.  Examining  the  perspectives  of  several 
stakeholders,  this  paper  addresses  the  strategic  implications  of  the  tension  between  a 
leader’s  interest  in  gathering  his  subordinates’  personal  information  and  the 
subordinate’s  interest  in  privacy.  This  paper  asserts  that  current  Army  and  DOD 
guidance  is  strategically  flawed.  Current  policy  risks  eviscerating  medical  privacy  and 
confidentiality  and  will  undermine  not  only  a  soldier’s  quality  of  life,  but  also,  mission 
readiness.  The  paper  recommends  changing  the  current  guidance  to  better  comport 
with  strategic  objectives. 


COMMANDER’S  “RIGHT  TO  KNOW”  HEALTH  INFORMATION:  A  STRATEGICALLY 

FLAWED  INNOVATION 

Commanders  play  a  critical  role  in  the  health  and  well-being  of  Soldiers, 
and  therefore,  require  sufficient  information  to  make  informed  decisions 
about  fitness  and  duty  limitations.1 

— Gen.  Peter  W.  Chiarelli, 

Vice  Chief  of  Staff,  US  Army 

A  battalion  commander  asks  his  unit  physician’s  assistant  (PA)  for  the  names  of 
all  soldiers  who  have  visited  behavioral  health2  services  and  all  soldiers  who  are  on  any 
behavioral  health  medications.  Armed  with  the  recently  coined  “commander’s  right  to 
know”  certain  health  information,  the  commander  believes  the  requested  information  will 
allow  him,  and  his  subordinate  leaders,  to  best  take  care  of  these  soldiers.  SPC  Jones, 
who  had  earlier  scheduled  an  appointment  with  a  behavioral  health  provider,  learns  of 
the  commander’s  new  policy  and  cancels  his  appointment. 

The  United  States  military’s  greatest  strategic  asset  is  its  Soldiers,  Sailors, 

Airmen  and  Marines.3  One  of  the  Army’s  strategic  objectives,  “sustaining]  an  all¬ 
volunteer  force  composed  of  highly  competent  Soldiers  that  are  provided  an  equally 
high  quality  of  life,”4  has  become  increasingly  challenging  to  accomplish  in  light  of  nearly 
ten  years  of  persistent  conflict  and  impending  budget  cuts.5  Key  to  a  service  member’s 
(SM)  quality  of  life  and  a  military  unit’s  performance  is  the  relationship  between  SMs 
and  their  leaders.  To  be  effective,  commanders,  senior  non-commissioned  officers  and 
other  unit  leaders  need  to  know  and  understand  their  troops.  Thus  quality  leaders  strive 
to  learn  as  much  about  their  personnel  as  possible.  At  the  same  time,  privacy  is  widely 
recognized  as  a  fundamental  right  of  all  Americans.  As  Justice  Louis  Brandeis 
observed,  the  “makers  of  the  Constitution  conferred  the  most  comprehensive  of  rights 


and  the  right  most  valued  by  all  civilized  men — the  right  to  be  let  alone.”6  Individual 
service  members,  like  all  United  States  citizens,  have  the  desire,  and  sometimes  the 
legal  right,  to  keep  certain  information  private.  In  the  context  of  medical  care,  privacy 
and  confidentiality  between  patients  and  healthcare  providers  advance  important 
societal  objectives.  Compelling  practical,  ethical  and  legal  reasons  justify  such  privacy, 
particularly  in  a  military  context  where  the  negative  stigma  associated  with  seeking 
behavioral  health  services  is  acute.  This  paper  addresses  the  strategic  implications  of 
the  tension  between  a  leader’s  interest  in  gathering  his  subordinates’  personal  medical 
or  mental  health  information  and  the  subordinate’s  interest  in  privacy. 

This  paper  asserts  that  current  Army  and  DOD  guidance  governing  disclosure  of 
service  members’  personal  health  information  is  strategically  flawed.  Current  policy 
risks  eviscerating  medical  privacy  and  confidentiality  and  will  undermine  not  only  a 
soldier’s  quality  of  life,  but  also,  mission  readiness. 

The  next  section  of  this  paper  discusses  how  privacy,  generally,  and,  in 
particular,  informational  privacy,  advances  important  societal  values  and  interests. 
Section  three  addresses  the  perspectives  of  three  key  stakeholder  groups:  healthcare 
providers  (with  emphasis  on  military  providers),  military  leaders,  and  service  members 
in  their  roles  as  patients  or  potential  patients.  Next,  the  paper  provides  the  legal  and 
regulatory  provisions  governing  military  health  information  disclosure.  The  paper  then 
analyzes  and  evaluates  the  current  military  guidance.  The  paper  finds  that  strategically 
the  current  approach  undermines  important  policy  ends,  including,  the  military’s 
objectives  to  maintain  a  high  quality  volunteer  force  and  to  reduce  stigma  associated 
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with  seeking  behavioral  health  services.  The  paper  concludes  with  recommendations  to 
alter  the  current  guidance  to  better  comport  with  strategic  objectives. 

The  Value  of  Privacy 

Philosophers,  ethicists,  and  legal  scholars  have  recognized  the  importance  and 
value  of  “privacy”  to  individuals  and  to  society.  While  no  consensus  exists  regarding  a 
definition  of  privacy,  certain  characteristics  have  coalesced  around  what  Justice  Louis 
Brandeis,  famously,  referred  to  as  the  “right  to  be  let  alone.”7  Privacy  is  a  “state  or 
sphere  where  others  do  not  have  access  to  a  person,  their  information,  or  their 
identity.”8  “Informational  privacy”  revolves  around  the  ability  to  control  when,  how  and  to 
what  extent  personal  information  is  communicated  to  others.9  Confidentiality,  which 
protects  certain  communications  between  individuals,  is  a  subset  of  privacy. 

Some  commentators,  particularly  ethicists,  see  privacy  as  a  basic  human  right 
based  on  the  principal  of  personal  autonomy.10  From  that  perspective,  privacy  is 
worthwhile,  in  and  of  itself,  because  it  advances  such  “fundamental  values”  as  “the 
ability  to  make  decisions,  individuality,  respect,  dignity  and  worth  as  human  beings.”11 

More  commonly,  privacy  is  viewed  as  beneficial  because  it  advances  more 
pragmatic  objectives.  For  individuals,  protecting  privacy  may  not  only  protect  an 
abstract  sense  of  dignity  but  also  serves  to  avoid  stigma  or  embarrassment,  and  may 
also  prevent  discrimination  or  economic  harm.12  In  addition,  privacy  helps  foster  healthy 
relationships.13  Finally,  several  commentators  have  observed  that  a  community  that 
respects  privacy  rights  is  the  type  of  a  free  society  in  which  Americans  want  to  live.14 

Privacy,  in  the  context  of  healthcare,  “has  come  to  be  linked  most  directly  with 
one’s  ability  to  make  decisions  related  to  one’s  body  without  intrusion  by  others.”15 

Medical  data  is  often  particularly  intimate.  For  the  reasons  discussed  above  -  stigma, 
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embarrassment,  discrimination  and  economic  harm  -  citizens  are  uniquely  concerned 
about  maintaining  privacy  of  their  health  information.16  Individuals  who  do  not  trust  that 
medical  information  will  be  kept  confidential  are  more  likely  to  avoid  going  to  doctors, 
withhold  information  from  their  healthcare  providers,  ask  their  healthcare  providers  to 
not  record  certain  information  or  request  physicians  to  mischaracterize  diagnoses.17 
Therefore,  protecting  health  data  improves  doctor-patient  communication  and  improves 
the  provision  of  healthcare  itself,  benefitting  individuals  and  society.  Thus,  very 
practical  consequences,  impacting  individuals  and  public  health,  result  from  the  failure, 
or  perception  of  failure,  to  protect  personal  health  information. 

Doctor’s  Perspective — Privacy  and  Confidentiality. 

Deeply  ingrained  ethical  standards  have  created  a  culture  within  the  medical 
community  that  deeply  respects  medical  privacy  and  confidentiality.  The  need  for 
medical  privacy  has  long  been  recognized.  The  Hippocratic  Oath  explicitly  requires  that 
a  physician  “not  divulge”  secrets  that  “ought  not  be  spoken  about.”18  More  broadly,  the 
deeply  ingrained  “nonmaleficence”  concept,  “do  no  harm,”  undergirds  the  ethical 
principal  of  privacy  because  privacy  breaches  could  embarrass,  stigmatize  or  result  in 
discrimination  of  the  patient  or  third  parties.19 

The  American  Medical  Association  (AMA)  treats  confidentiality  as  a  subset  of 
privacy.  While  “confidentiality”  pertains  to  “information  told  in  confidence  or  imparted  in 
secret,”  privacy  involves  any  “information  that  is  concealed  from  others  outside  of  the 
patient-physician  relationship.”20  Thus,  “privacy”  would  include  a  patient’s  “thoughts  or 
feelings,”21  a  doctor’s  observations  or  laboratory  results,  while  confidentiality  pertains 
primarily  to  communications  between  doctor  and  patient. 
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The  AMA  Code  of  Medical  Ethics  protects  medical  privacy  and  confidentiality.  It 
provides  that  physicians  “shall  safeguard  patient  confidences  and  privacy  within  the 
constraints  of  the  law.”22  In  addition  to  legal  constraints,  the  standard  recognizes  that 
privacy  must  be  balanced  against  the  efficient  provision  of  care.23 

Privacy,  from  the  medical  ethics  perspective,  is  considered  a  right  of  every 
individual.24  Protecting  privacy  serves  as  a  “fundamental  expression  of  patient 
autonomy”  and  builds  “the  trust  that  is  at  the  core  of  the  patient-physician  relationship.”25 
In  contrast,  confidentiality  arises  from  a  formal  or  informal  agreement  between  a 
physician  and  patient  that  information  divulged  by  another  person  will  not  be  further 
disseminated.  The  obligation  of  confidentiality  arises  with  the  relationship  between 
patient  and  doctor.26 

Confidentiality  is  a  core  precept  in  the  practice  of  medicine.27  The  AMA  Ethics 
Code  provides  that  normally  a  physician  should  not  disclose  confidential  information 
because  confidentiality  is  necessary  to  “effectively  provide  needed  services.”28  The 
Code  recognizes,  however,  that  “overriding  considerations”  allow  physicians  to  disclose 
confidences  without  the  consent  of  the  patient.29  One  “overriding  consideration” 
permitting  disclosure  is  when  a  “patient  threatens  to  inflict  serious  physical  harm  to 
another  person  or  to  him  or  herself  and  there  is  a  reasonable  probability  that  the  patient 
may  carry  out  the  threat.”30  Thus,  AMA  ethical  guidance  recognizes  the  tension 
between  safeguarding  patient  confidences  and  public  policies  requiring  disclosure.31 
When  the  law  requires  disclosure,  physicians  must  disclose  only  minimal  confidential 
information.32 
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The  AMA  Ethics  guidelines  urge  physicians  to  attempt  to  change  any  law  that  is 
inconsistent  with  the  best  interests  of  a  patient.33  Regarding  confidentiality,  physicians 
faced  with  legal  requirements  contrary  to  ethics  principles  should  “advocate  for  the 
protection  of  confidential  information  and,  if  appropriate,  seek  a  change  in  the  law.”34 

According  to  the  AMA  Council  on  Ethical  and  Judicial  Affairs,  the  practical 
benefits  of  confidentiality  flow  from  reciprocal  duties  between  doctor  and  patient. 
Confidentiality’s  “value  in  the  context  of  the  patient-physician  relationship  stems  partly 
from  the  need  for  patients  to  trust  their  physicians,  and  for  physicians  to  express  their 
loyalty  to  patients.”35  According  to  the  AMA,  a  physician’s  ethical  obligations  center  on 
advancing  the  patient’s  interest.  In  contrast,  the  law  generally  seeks  to  advance  the 
public’s  interests.36  As  seen  in  the  next  section,  military  healthcare  providers  must 
advance  the  interests  of  a  third  entity:  the  Armed  Forces. 

Challenges  Unique  to  Military  Health  Care  Providers 

Military  healthcare  providers  (HCP)  face  the  problem  of  “dual  loyalty,”  also  known 
as  “mixed  agency”  or  “conflict  of  interests.”37  Two  sets  of  professional  ethics  govern  the 
conduct  of  military  HCPs  -  one  demands  loyalty  to  the  military  mission,  the  other  to  the 
individual  patient.  Uniformed  healthcare  providers  differ  from  their  civilian  counterparts 
because  they  are  commissioned  officers,  dedicated  to  the  military  mission  with  military 
duties  and  part  of  the  military  hierarchy.38  While  in  most  situations  the  two  sets  of 
ethical  demands  point  in  the  same  direction,  at  times  they  conflict.  Resolving  such 
conflicts  may  involve  law,  ethics  and  personal  moral  discretion.  Unfortunately,  as  one 
commentator  observed,  the  military  fosters  “an  organizational  culture  that  is  often 
disinterested  in,  if  not  overtly  hostile,  to  the  concept  of  service  member  confidentiality.”39 


6 


In  Military  Medical  Ethics,  Edmund  Howe,  describes  three  categories  of  ethical 
dilemmas.  The  “first  category  is  one  in  which  military  physicians  should  exercise  no 
discretion  because  the  needs  of  the  military  should  be  absolute.”40  When  disaster 
would  result  from  advancing  an  individual  patient’s  interests  over  the  military’s  needs, 
such  as  loss  of  hundreds  of  lives,  defeat  in  battle  or  perhaps  loss  of  war  itself,  then  the 
physician  must  disregard  the  patient’s  interest.  For  example,  military  doctors  may 
ethically  treat  soldiers  with  combat  fatigue  in  such  a  way  that  encourages  them  to  return 
to  combat.41  The  “military  needs  should  prevail  because  the  consequences  of  not  doing 
so  are  unthinkable.  The  national  security  interest,  and  therefore  the  ‘military  necessity,’ 
is  compelling.”42 

At  the  other  extreme,  lie  circumstances  in  which  a  military  physician’s  medical 
ethics  must  mirror  a  civilian  colleague’s.  For  example,  a  military  physician  should  not 
disclose  that  a  military  patient  told  the  physician,  in  the  course  of  treatment,  that  he  was 
having  an  extra-marital  affair.43  In  that  instance,  the  physician’s  duty  of  confidentiality 
defeats  any  perceived  military  advantage.  Because  the  “patient  has  a  clear  medical 
interest”  and  the  “military  has  virtually  none,”44  the  physician  must  adhere  to  his  civilian 
role  medical  ethical  responsibilities. 

Howe  indicates  that  scenarios  at  either  end  of  the  spectrum  are  rare.45  Rather, 
the  military  physician  is  more  likely  to  face  challenges  requiring  the  exercise  of 
discretion.  In  this  “area,  physicians  must  weigh  choices  and  obligations  to  ensure  the 
best  treatment  possible  for  patients  within  the  context  of  military  interests.”46 
Confidentiality  issues  often  fall  into  this  category.  Howe  discusses  balancing  military 
needs  with  patient  confidentiality  in  the  context  of  treating  pilots47  or  senior  officers.48 
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Each  has  tremendous  responsibility  for  the  lives  and  safety  of  others.  Nonetheless,  if 
information  learned  from  these  patients  has  minimal  impact  on  the  military  mission,  a 
doctor  would  not  necessarily  have  to  disclose  confidential  information.  Howe  discusses 
several  questions  a  doctor  should  consider  in  exercising  discretion,  including:  are  there 
specific  laws  or  regulations  governing  disclosure;  what  is  the  likely  gain  to  the  military 
compared  to  the  harm  to  the  patient;  what  is  the  risk  to  the  physician  of  disclosure  or 
non-disclosure;  what  informed  consent  did  the  patient  provide;  what  other  “promise,” 
implicit  or  explicit,  existed  between  patient  and  physician.49 

Health  care  providers,  of  course,  are  only  a  small  sub-set  of  the  military 
community.  The  next  section  addresses  health  information  privacy  from  the 
perspectives  of  military  leaders  and  service  members. 

Unique  Military  Environment:  Leader’s  Perspective  and  Service  Member’s  Reduced 
Expectation  of  Privacy 

Courts  have  “long  recognized  that  the  military  is,  by  necessity,  a  specialized 
society  separate  from  civilian  society.”50  As  a  result  of  the  “different  character  of  the 
military  community  and  of  the  military  mission,”  Constitutional  protections  apply 
differently  to  military  members.51  Though  no  court  has  ruled  on  the  right  of  information 
privacy  in  the  military,  undoubtedly,  the  right  would  be  applied  differently  than  in  the 
civilian  world. 

The  highest  military  court  has  recognized  “the  responsibility  and  accountability  of 
commanders  for  the  successful  conduct  of  military  operations.”52  In  the  context  of 
searches  and  seizures,  military  courts  have  recognized  the  far-reaching  roles  and 
responsibilities  of  commanders:  “A  military  commander  has  responsibilities  for 
investigation  and  for  law  enforcement ....  Also,  he  has  responsibilities  for  the  welfare 
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and  combat  readiness  of  the  personnel  under  his  command.”53  Not  only  must 
commanders  accomplish  the  most  challenging  combat  missions,  but  they  must  also 
take  care  of  the  Soldiers,  Sailors,  Airmen  and  Marines  under  their  command.  Army 
commanders  are  responsible  for  the  welfare  of  soldiers  at  various  levels.  By  Army 
regulation,  “Every  leader  will —  .  .  .  c.  Ensure  the  physical,  moral,  personal,  and 
professional  wellbeing  of  subordinates.”54  Further,  the  depth  of  understanding  which 
commanders  and  subordinate  leaders  are  expected  to  reach  is  astonishing.  For 
example,  “Leaders  must  monitor  assigned  personnel  routinely  and  become  familiar 
enough  with  unit  members  to  assess  the  personal  risk  factors  of — Financial  problems; 
Alcohol  misuse;  Immaturity;  Relationship  problems.”55 

Key  to  any  military  unit’s  performance  is  the  relationship  between  service 
members  (SMs)  and  their  leaders.  To  take  care  of  a  SM  at  a  personal  level,  leaders 
need  to  ask  questions  and  get  information  from  various  sources.  Medical  data  will  often 
be  relevant.  As  the  Army’s  Vice  Chief  of  Staff  observed  “Commanders  play  a  critical 
role  in  the  health  and  well-being  of  Soldiers,  and  therefore,  require  sufficient  information 
to  make  informed  decisions  about  fitness  and  duty  limitations.”56  Greater  knowledge 
gives  the  commander  better  tools  to  help  the  soldier. 

Although  the  courts  have  not  addressed  information  or  medical  privacy  in  a 
military  environment,  their  analysis  of  privacy  in  the  Fourth  Amendment  context  (search 
and  seizure  law)  is  instructive.  In  the  Fourth  Amendment  context,  the  ‘“expectation  of 
privacy’  ...  is  different  in  the  military  than  it  is  in  civilian  life.”57  History,  custom  and  the 
role  of  the  commander,  result  in  lawfully  vesting  commanders  with  substantial  authority 
and  concomitantly  limiting  service  members’  reasonable  expectation  of  privacy.58 


9 


Application  of  “the  Fourth  Amendment”  must  “take  into  account  the  exigencies  of 
military  necessity  and  unique  conditions  that  may  exist  within  the  military  society.”59  As 
a  result,  a  commander  can  not  only  order  a  search  based  on  probable  cause,  but  also 
has  the  authority,  unprecedented  in  the  civilian  world,  to  order  an  inspection  of  a  whole 
or  part  of  a  unit  to  determine  “security,  military  fitness,  or  good  order  and  discipline.”60 
These  authorities  flow  from  the  service  member’s  reduced  expectation  of  privacy  and 
the  far-reaching  role  of  the  military  commander.61 

Case  law,  however,  recognizes  that  effective  leadership  is  not  primarily  defined 
by  discipline,  punishment  or  legal  constraints.  Rather,  a  critical  “aspect  of  successful 
leadership  is  concern  for  the  welfare  of  subordinates.  Loyalty  in  a  military  unit ...  is  a 
two-way  street.”62  That  is,  the  relationship  between  soldiers  and  leaders,  like  the 
relationship  between  doctor  and  patient,  is  based  on  trust.  A  “commander  who 
approves  or  even  tolerates  arbitrary  invasions  of  the  privacy  of  his  subordinates  is  not 
demonstrating  the  brand  of  leadership  likely  to  command  the  loyalty  or  produce  the  high 
morale  associated  with  a  combat-ready  organization.”63  Although  the  court  was 
discussing  privacy  in  the  context  of  searches  and  seizures,  the  same  concept  applies  to 
medical  information  privacy:  effective  leadership  recognizes  that  honoring  privacy 
reflects  respect  for  service  members’  dignity,  improves  relationships  and  builds  better 
units. 

Service  Member  As  Patient:  Particular  Sensitivity  To  Disclosure  Of  Health  Information. 

Although  service  members  have  a  lesser  expectation  of  privacy  than  civilians 
under  the  law,  they  may  have  greater  subjective  need  for  medical  privacy  and 
confidentiality.  “Alarming  levels”  of  behavioral  health  and  substance  abuse  problems 
have  been  reported  among  service  members  returning  from  Operations  Enduring 
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Freedom  and  Iraqi  Freedom.64  The  “signature”  injuries  of  these  conflicts  are  not  always 
visible.  Psychological  injuries,  foremost  among  them  Post-Traumatic  Stress  (PTS),  and 
neurological  injuries,  primarily  Traumatic  Brain  Injury  (TBI),  have  proven  challenging  to 
identify  and  treat.  One  of  the  primary  barriers  to  effective  care  of  PTS  and  TBI  has 
been  the  stigma,  or  perception  of  stigma,  associated  with  service  members  seeking 
behavioral  health  services.  Keeping  behavioral  health  information  confidential  is  one 
critical  means  to  reduce  the  stigma  of  seeking  behavioral  health  services. 

Service  members  are  concerned  that  seeking  mental  health  treatment  would 
damage  their  careers  and  influence  how  they  are  viewed  by  unit  leadership.65  In  June 
2007,  the  Department  of  Defense  Mental  Health  Task  Force  (MHTF),  reported,  “[sjtigma 
[associated  with  seeking  mental  health  services]  in  the  military  remains  pervasive  and 
often  prevents  service  members  from  seeking  needed  care.”66  The  Army’s 
comprehensive  study  on  Health  Promotion/Risk  Reduction/Suicide  Prevention 
(HP/RR/SP  Report)  defined  stigma  as  “the  perception  among  leaders  and  Soldiers  that 
help-seeking  behavior  will  either  be  detrimental  to  their  career  (e.g.,  prejudicial  to 
promotion  or  selection  to  leadership  positions),  or  that  it  will  reduce  their  social  status 
among  their  peers.”67  Stigma  contributes  to  soldiers’  failure  to  obtain  needed  mental 
health  services.68  The  Mental  Health  Task  Force  identified,  “Dispelling  Stigma,”  as  its 
first  recommendation  to  build  a  culture  of  support  for  psychological  health69  and  thereby 
improve  the  efficacy  of  mental  health  services  provided  to  Service  Members.70  Failure 
to  obtain  behavioral  healthcare  contributes  to  increased  suicides,  untreated  PTS  and 
TBI,  and  a  host  of  other  soldier  and  soldier-family  problems. 
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Over  the  last  two  years,  both  DOD  and  the  Army  have  made  concerted  efforts  to 
reduce  the  stigma  associated  with  a  service  member  seeking  behavioral  health 
assistance.  The  Vice  Chief  of  Staff  of  the  Army  (VCSA),  General  Peter  Chiarelli,  has 
made  improved  behavioral  health,  generally,  and  reduction  of  stigma,  more  particularly, 
among  his  top  priorities.71  The  VCSA  has  spoken  and  written  frequently  on  reducing  the 
stigma  of  “seeking  help.”72  He  has  stated,  the  Army  must  “reduce  the  stigma  associated 
with  help-seeking  behavior.”73  Attention  from  military  leaders  advances  a  cultural 
change  reducing  the  stigma  of  seeking  mental  health  assistance.74 

Recognizing  the  benefits  that  flow  from  allowing  service  members  to  keep  mental 
health  services  confidential,  DOD  recently  revised  the  mental  health  question  on  the 
standard  security  questionnaire.75  As  of  March  2010,  the  revised  question  exempts 
from  reporting  any  counseling  “strictly  related  to  adjustments  from  service  in  a  military 
combat  environment”  and  explicitly  states,  “Mental  Health  counseling  in  and  of  itself  is 
not  a  reason  to  revoke  or  deny  a  security  clearance.”76  DOD  recognized  that  service 
members  perceive  that  disclosure  of  mental  health  information  will  have  a  negative 
impact  on  obtaining  (or  retaining)  a  security  clearance  and  hence  a  negative  impact  on 
their  career.  This  is  a  concrete  example  of  the  economic  harm  (or  at  least  the 
perception  of  such  harm)  that  could  result  from  disclosure,  even  self-disclosure,  of 
medical  information.77 

Three  programs,  two  from  the  Army  and  one  from  DOD,  explicitly  seek  to  reduce 
stigma  by  enhancing  privacy  or  confidentiality.  First,  the  Army  initiated  the  Virtual 
Behavioral  Health  Program  where  soldiers  can  obtain  behavioral  health  consultations 
through  video-conferencing.78  The  counseling  sessions  can  take  place  from  a  service 
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member’s  home  during  non-duty  hours.  By  creating  a  method  to  obtain  behavioral 
health  services  in  private,  outside  of  the  service  member’s  unit  environment,  this 
program  seeks  to  reduce  stigma.  Second,  the  Confidential  Alcohol  Treatment 
Education  Pilot  (CATEP)  provides  confidential  means  for  Soldiers  to  refer  themselves 
for  Alcohol  Substance  Abuse  Program  (ASAP)  treatment  without  command  notification 
and  subsequent  administrative  or  disciplinary  action.79  The  program  was  designed  to 
allow  soldiers  to  seek  help  without  fear  of  damage  to  their  careers.80  The  CATEP 
Program  was  specifically  designed  “in  response  to  the  belief  that  command  stigma 
originating  from  supervisors  and  peers  represents  a  significant  barrier  to  treatment.”81  A 
preliminary  examination  of  CATEP  revealed  the  program’s  confidentiality  provisions 
have  increased  the  likelihood  soldiers  will  seek  treatment.82  Finally,  Military 
OneSource83  offers  up  to  twelve  sessions  of  face-to-face,  telephonic  or  on-line 
counseling  outside  of  the  Tricare  system  and  without  notification  to  the  chain  of 
command.  Confidentiality  is  maintained  except  to  meet  legal  obligations  mirroring  those 
in  a  civilian  context.84  Military  OneSource  counselors  will  keep  information  private 
except  to  prevent  harm  to  the  patient  or  others,  or  to  report  family  maltreatment, 
substance  abuse  or  illegal  activities.85 

The  principles  and  interests  discussed  in  this  and  previous  sections  form  the 
basis  for  laws  and  regulations  governing  health  information  privacy.  The  following 
section  addresses  United  States’  case  law  and  regulations  and  the  military’s 
implementation  thereof. 

Legal  and  Regulatory  Provisions 

Case  Law.  According  to  the  information  privacy  legal  scholar,  Daniel  Solove,  the 
tort  of  breach  of  confidentiality  arose  in  the  early  20th  Century  and  by  the  end  of  the 
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century  had  been  recognized  by  most  American  jurisdictions.86  He  described  the 
parameters  of  the  tort  as  “a  cause  of  action  against  a  physician  for  the  unauthorized 
disclosure  of  confidential  information  unless  the  disclosure  is  compelled  by  law  or  is  in 
the  patient’s  interest  or  the  public  interest.”87  In  1977,  in  Whalen  v.  Roe,  the  Supreme 
Court  recognized  a  constitutional  privacy  “interest  in  avoiding  disclosure  of  personal 
matters.”88  Very  recently,  the  Supreme  Court,  “assume[d],  without  deciding,  that  the 
Constitution  protects  a  privacy  right  of  the  sort  mentioned  in  Whalen ,”89  Although  the 
Supreme  Court  has  never  expounded  on  the  limits  of  such  a  right,  some  federal 
appellate  courts  have  broadly  interpreted  the  right  to  informational  privacy.90  In  sum, 
the  law  values  medical  information  privacy  and  protects  against  inappropriate 
disclosures  of  confidential  information  by  both  physicians  and  government  actors. 

HIPAA  Privacy  Rule.  President  Clinton  signed  the  Health  Insurance  Portability 
and  Accountability  Act  (HIPAA)  on  August  21 ,  1 996. 91  The  Department  of  Health  and 
Human  Services  (HHS)  published  regulations,  known  collectively  as  the  “Privacy  Rule,” 
governing  privacy  and  confidentiality  of  medical  information  on  August  14,  2002. 92 

The  drafters  intended  the  regulations  to  create  a  scheme  that  sufficiently 
protected  individual  health  information  while  allowing  the  flow  of  information  necessary 
to  promote  high  quality  care.93  According  to  HHS,  “a  major  purpose  of  the  Privacy  Rule 
is  to  define  and  limit  the  circumstances  in  which  an  individual’s  protected  heath 
information  may  be  used  or  disclosed.”94  The  HIPAA  rules  apply  to  health  plans  and 
healthcare  providers,95  including  military  healthcare  providers.96  Referred  to  as 
“Protected  Health  Information  (PHI),”  HIPAA  protects  information  that  identifies  an 
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individual  and  “relates  to”  the  “individual’s  past,  present  or  future  physical  or  mental 
health  or  condition  [or]  the  provision  of  healthcare  to  the  individual.”97 

A  covered  entity  may  disclose  PHI  under  two  general  circumstances:  the 
individual  patient  authorizes  disclosure  in  writing  or  “as  the  Privacy  Rule  permits.”98  A 
covered  entity  may,  but  is  not  required  to,  disclose  PHI  without  an  individual’s 
authorization  under  various  limited  circumstances  under  HIPAA."  In  most  instances, 
“covered  entities  may  rely  on  professional  ethics  and  best  judgments  in  deciding  which 
of  these  permissive  uses  and  disclosures  to  make.”100  Covered  entities  may  disclose 
PHI  to  healthcare  providers  for  treatment  purposes.101  Further,  the  privacy  rule  permits, 
but  does  not  mandate,  disclosure,  without  an  individual’s  permission  for  “12  national 
priority  purposes.”102  Each  purpose  has  its  own  rules,  “striking  the  balance  between  the 
individual  privacy  interest  and  the  public  interest  need”  for  the  information.103  These 
purposes  include:  when  required  by  law;104  for  public  health  purposes;105  regarding 
victims  of  abuse;106  for  health  oversight  activities;107  in  judicial  and  administrative 
proceedings;108  for  law  enforcement  purposes  under  certain  circumstances;109  to  prevent 
a  serious  and  imminent  threat  to  a  person  or  the  public;110  for  certain  essential 
government  functions.111 

The  Privacy  Rule  contains  a  more  restrictive  provision  for  psychotherapy  notes. 
Without  the  permission  of  the  patient,  the  Privacy  Rule  limits  disclosure  solely  “to 
averting]  a  serious  and  imminent  threat  to  public  health  or  safety,  to  a  health  oversight 
agency  ...  or  as  required  by  law.”112 

Consistent  with  the  ethical  standards  discussed  above,  a  central  aspect  of  the 
Privacy  Rule  is  the  principle  of  “minimum  necessary”  disclosure.113  That  is,  a  “covered 
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entity  must  make  reasonable  efforts  to  ...  disclose,  only  the  minimum  amount  of  PHI 
needed  to  accomplish  the  intended  purpose  of  the  ...  disclosure.”114 

DOD  and  Army  Implementation  of  HIPAA.  The  HHS-developed  Privacy  Rule 
explicitly  allows  the  military  to  disclose  PHI  of  military  personnel  “for  activities  deemed 
necessary  by  appropriate  military  command  authorities  to  assure  the  proper  execution 
of  the  military  mission.”115  DOD  implemented  HIPAA  in  DOD  Regulation  6025.1 8-R, 
DOD  Health  Information  Privacy  Regulation  in  January  2003. 116  The  Regulation 
expounds  on  how  the  HHS’  exception  applies  to  the  military.117  The  Regulation  set  forth 
five  bases  for  which  PHI  may  be  disclosed  absent  service  member  authorization.  Two 
were  quite  specific:  “To  carry  out  [Joint  Medical  Surveillance]  activities”  and  to  “report  on 
casualties  in  any  military  operation.”  Three  others,  however,  broadly  describe  permitted 
disclosure  circumstances: 

To  determine  the  member's  fitness  for  duty  ...  To  determine  the  member's 
fitness  to  perform  any  particular  mission,  assignment,  order,  or  duty, 
including  compliance  with  any  actions  required  as  a  precondition  to 
performance  of  such  mission,  assignment,  order,  or  duty....  To  carry  out 
any  other  activity  necessary  to  the  proper  execution  of  the  mission  of  the 
Armed  Forces.118 

On  July  2,  2009,  DOD,  acting  on  recommendations  of  the  DOD  Mental  Health 
Task  Force  (MHTF)  published  a  directive-type  memorandum  (DTM)  entitled  “Revising 
Command  Notification  Requirements  to  Dispel  Stigma  in  Providing  Mental  Health 
Care  to  Military  Personnel.”119  The  MHTF  found  that  the  “low  thresholds  for  notifying 
commanders  of  Service  members’”  mental  healthcare  resulted  in  “members  not  seeking 
treatment,  yet  continuing  in  their  operational  roles,  while  their  problems” 120  grew  worse. 
The  directive  sought  to  better  balance  patient  confidentiality  with  a  commander’s  need 
to  know  information  for  operational  and  risk  management  purposes.121  The  directive, 
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either  intentionally  or  inadvertently,  introduced  the  term  “commander’s  right  to  know” 
(emphasis  added)  in  regards  to  certain  health  information.  This  term  does  not  appear, 
previously  or  subsequently,  in  any  other  context.122 

The  DTM  delineated  eight  mental  health  conditions  requiring  a  healthcare 
provider  to  proactively  notify  a  commander  of  the  member’s  condition:  serious  risk  of 
self-harm;  serious  risk  of  harm  to  others,  including  child  abuse  or  domestic  violence; 
serious  risk  of  harm  to  a  specific  military  operational  mission;  members  in  the  Personal 
Reliability  Program  or  a  position  of  similar  sensitivity  or  urgency;  inpatient  care;  member 
is  experiencing  an  acute  medical  condition  that  interferes  with  duty;  member  has 
entered  a  substance  abuse  treatment  program;  and,  a  command-directed  mental  health 
evaluation.123  Finally,  consistent  with  the  Privacy  Act,  the  directive  requires 
commanders  to  restrict  further  dissemination  of  the  disclosed  information  to  personnel 
with  a  need  for  the  information. 

In  early  2010,  the  Army  issued  a  Rapid  Action  Revision  (RAR)  of  Army 
Regulation  40-66  (AR  40-66  Revision),  Medical  Record  Administration  and  Healthcare 
Documentation.  The  revision  emphasized  new  requirements  placed  on  healthcare 
providers  to  communicate  with  commanders.  The  Regulation  directs  unit  surgeons, 
“when  available  and  appropriate”  to  be  involved  in  the  “communication  of  a  Soldier’s 
PHI  to  a  unit  commander.”124  More  pointedly,  the  regulation  directed  unit  surgeons  to 
“provide  timely  and  accurate  information  to  support  unit  commanders’  decision  making 
pertaining  to  the  health  risks,  medical  fitness,  and  readiness  of  their  Soldiers.”125 

The  AR  40-66  Revision  set  forth,  in  great  detail,  those  regulatory  programs 
authorizing  disclosure  within  DOD  of  PHI  without  the  consent  of  soldiers.  Under  the 
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category  “when  required  by  law  or  Government  regulation,”  the  regulation  revision  listed 

18  specific  regulatory  bases  permitting  disclosure.126  Further,  it  included  a  “catch-all” 

authorization,  i.e.,  “[according  to  other  regulations  carrying  out  any  other  activity 

necessary  to  the  proper  execution  of  the  Army’s  mission.”127  Finally,  AR  40-66  provides 

eight,  non-exclusive,  situations  in  which  MTF  Commanders  “will  proactively  inform  a 

commander  of  a  soldier’s  minimum  necessary  PHI:” 

To  avert  a  serious  and  imminent  threat  to  health  or  safety  of  a  person, 
such  as  suicide,  homicide,  or  other  violent  action128...  (b)  A  high  risk 
Soldier  receives  multiple  behavioral  health  services  and  requires  high  risk 
multi-disciplinary  treatment  plans.129  ...  (c)  Medications  could  impair  the 
Soldier’s  duty  performance.130 ...  (d)  The  Soldier’s  condition  impairs  his/her 
performance  of  duty.131  (e)  The  injury  indicates  a  safety  problem  or  a 
battlefield  trend,  (f)  There  is  a  risk  of  heat/cold  injury,  (g)  The  Soldier 
requires  hospitalization,  (h)  The  Soldier  is  categorized  as  seriously  ill  or 
very  seriously  ill.132 

On  28  May  2010,  the  VCSA  published  a  message  on  PHI.133  The  message  was 
intended  to  “improve  information  and  data  disclosure.”134  The  message  is  commander- 
focused,  emphasizing  that  “commanders  play  a  critical  role  in  the  health  and  well-being 
of  their  soldiers.”135  As  a  result,  commanders  “require  sufficient  information  to  make 
informed  decisions  about  fitness  and  duty  limitations.”136  The  message  includes  one  of 
the  broadest  descriptions  of  when  health  care  providers  must  disclose  PHI  by  requiring 
medical  personnel  to  provide  “timely  information  ...  when  health  problems  exist  that  may 
impair  a  soldier’s  fitness  for  duty”  (emphasis  added).137 

The  message  recognizes  limits  on  releasability  and  directs  that  the  soldier’s  “right 
to  the  privacy  of  his/her”  PHI,  be  balanced  with  mission  requirements  and  the 
“commander’s  right  to  know.”138  The  message  recognizes  that  “it  would  be 
counterproductive  for  soldiers  to  perceive  increased  stigma,  or  not  seek  medical  care, 
because  of  inappropriate  release  of  PHI.”139  The  message  states  that  “collaborative 
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communication”  between  commanders  and  “healthcare  providers  is  critical  to  the  health 
and  well-being  of  our  soldiers.”140  The  message  directs  healthcare  providers  to  “not  limit 
communication  to  ‘sick  call  slips,’  but  should  speak  with  commanders  when  required.”141 

Based  on  the  VCSA’s  message,  the  Army  Medical  Command  and  Office  of  the 
Surgeon  General  published  Policy  Memorandum  10-042,  “Release  of  Protected  Health 
Information  to  Unit  Command  Officials.”142  The  policy  directs  medical  commanders  to 
“provide  timely  and  accurate  information  to  support  unit  commanders’  decision-making 
pertaining  to  the  health  risks,  medical  fitness  and  readiness”  of  soldiers.143  The  policy 
further  encourages  communication  between  command  and  medical  personnel.  The 
message  captures  regulatory  guidance,  previously  discussed  in  this  paper,  authorizing 
disclosure,  including  five  circumstances  in  which  the  minimum  necessary  disclosure  of 
PHI  may  be  made  absent  soldier  authorization  and  22  examples  of  “regulatory  and 
command  management  programs  that  do  not  require  a  Soldier’s  authorization  for  PHI 
disclosure.”144 

Finally,  service  members’  health  information  is  protected  by  both  the  Privacy  Act 
and  DOD’s  regulation  implementing  HIPAA.145  If  PHI  is  disclosed  within  DOD  pursuant 
to  HIPAA,  that  information  is  then  protected  from  further  dissemination  only  by  the 
Privacy  Act.146  Thus,  if  doctors  disclose  PHI  to  commanders,  HIPAA  rules  no  longer 
apply,  but  instead  the  relatively  more  lenient  standards  of  the  Privacy  Act  protect  such 
information  from  additional  disclosure.147  Within  DOD,  disclosure  would  be  permitted  to 
anyone  with  an  official  need  to  know.148 
Analysis  and  Evaluation 

Analysis  of  the  current  DOD  and  Army  health  privacy  guidelines  leads  to  two 
major  conclusions.  First,  recent  changes  in  regulation  and  policy  risk  substantially 
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reducing  healthcare  privacy  and  confidentiality  in  the  military.  Second,  less  privacy  will 
undermine  military  readiness.  This  second  conclusion  stems  from  several  related 
causes:  less  privacy  directly  contradicts  efforts  to  reduce  the  stigma  of  seeking 
behavioral  health  services  and  hence  will  undercut  efforts  to  address  Post  Traumatic 
Stress,  Traumatic  Brain  Injury  and  related  wartime  maladies;  less  privacy  will  undermine 
trust  and  loyalty  between  service  member  and  leader;  less  privacy  will  undermine  the 
doctor-military  patient  relationship,  putting  military  healthcare  providers  in  an  untenable 
ethical  position  and  reducing  the  effectiveness  of  medical  care;  and,  reduced  privacy 
will  negatively  impact  on  retention  of  service  members. 

Interestingly,  recent  guidance  purports  to  recognize  the  need  to  balance  a 
service  member’s  interest  in  privacy  with  a  leader’s  interest  in  gaining  information.  The 
recent  DTM,  for  example,  states  that  its  purpose  is  to  address  the  “low  thresholds”  that 
exist  allowing  healthcare  providers  to  disclose  PHI  to  leaders.  Similarly,  the  VCSA’s 
message  expresses  concern  that  “we  must  balance  the  soldier's  right  to  the  privacy  of 
his/her  protected  health  information  (PHI)  with  mission  requirements  and  the 
commander's  right  to  know.  It  would  be  counterproductive  for  soldiers  to  perceive 
increased  stigma,  or  not  seek  medical  care,  because  of  the  inappropriate  release  of 
PHI.”149  Unfortunately,  the  recent  guidance,  taken  together,  strikes  the  wrong  balance 
and  will  cause  the  perception,  at  a  minimum,  of  a  “pass-through”  of  information  between 
doctors  and  commanders.  Some  of  the  very  evils  of  which  the  VCSA  warns  -  increased 
stigma  and  failure  to  seek  medical  care  -  and  others,  will  come  to  fruition. 

The  DOD  and  the  Army  have  taken  several  steps,  each  discussed  individually 
below,  to  substantially  expand  service  members’  PHI  subject  to  disclosure.  First, 
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military  guidance  broadly  defines  mission  needs  by  mandating  or  permitting  disclosures 
pursuant  to  a  wide  variety  of  regulations.  Second,  whereas  most  of  the  civilian  Privacy 
Rule  disclosures  are  permissive,  DOD  introduces  numerous  mandatory  disclosures 
which  military  HCPs  must  proactively  disclose.  In  addition,  DOD  recently  asserted  that 
commander’s  have  a  “right  to  know”  PHI  under  certain  circumstances.  Finally,  the  Army 
recently  promulgated  guidance  requiring  communications  between  commanders  and 
healthcare  providers  concerning  a  service  member’s  medical  status. 

Recent  Changes  Risk  Substantially  Reducing  Health  Care  Privacy  in  the  Military. 
The  initial  approach  of  the  2003  DOD  regulation  concerning  privacy  left  the  door  open 
for  a  substantially  more  disclosure-friendly  approach  than  corresponding  civilian  rules. 
Disclosure  of  PHI  is  permitted  on  several  vague  and  amorphous  grounds:  “fitness  for 
duty,”  “fitness  for  a  particular  mission,”  and  “to  carry  out  any  other  activity  necessary  to 
the  proper  execution  of  the  mission.”  Nonetheless,  this  difference  alone  did  not 
substantially  impact  military  medical  privacy  in  a  negative  manner.  The  culture  of 
confidentiality  and  privacy,  instilled  in  all  physicians,  successfully  counter-balanced  the 
more  disclosure-permitting  DOD  regulation.  Three  recent  publications  in  the  area  of 
military  healthcare  privacy,  however,  when  viewed  together  risk  vastly  and 
inappropriately,  expanding  the  information  that  providers  disclose  to  commanders  and 
other  unit  leaders. 

First,  AR  40-66  and  the  recently  published  OTSG  Message  provide  a  lengthy  list 
of  circumstances  permitting  disclosure  of  PHI.  This  list  risks  the  disclosure  exceptions 
swallowing  the  privacy  rule.  Even  though  each  of  these  exceptions  only  allows 
information  to  be  disclosed  for  a  particular  regulatory  purpose,  once  released  from 
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healthcare  providers,  the  information  is  no  longer  protected  by  HIPAA.  Instead,  only  the 
Privacy  Act  stands  in  the  way  of  subsequent  disclosures.  Further,  while  the  medical 
profession  instills  in  its  members  a  culture  that  values  confidentiality,  that  cultural  value 
is  not  widely  shared  throughout  the  military.  Therefore,  once  released  out  of  medical 
channels,  information  is  more  likely  to  be  widely  shared. 

Secondly,  the  2009  DOD  DTM  gave  commander’s  a  “right  to  know”  certain  health 
information.  The  Army  quickly  adopted  the  term  and  the  VCSA  used  it  in  his  2010 
VCSA  memorandum.  In  addition,  the  VCSA  memorandum  adopted  one  of  the  broadest 
approaches  to  disclosure,  directing  military  HCPs  to  provide  “timely  information  ...  when 
health  problems  exist  that  may  impair  a  soldier’s  fitness  for  duty.”150  Finally,  the  VCSA 
urged  additional  communication  between  healthcare  providers  and  commanders.151 

The  communication  directive,  coupled  with  the  newly  introduced  commander’s 
“right  to  know”  and  the  extant  lengthy  list  of  permitted  regulatory  disclosures,  risks 
medical  professionals  becoming,  or  at  least  being  perceived  as  becoming,  a  “pass¬ 
through”  to  unit  leaders  for  private  medical  information.  The  Army’s  emphasis  on 
“communication”  between  healthcare  providers  and  commanders  will  open  the  flood 
gates  of  information.  “Minimum  necessary”  disclosure  will  wither  in  the  face  of  person- 
to-person  questioning  from  a  commander. 

Howe,  writing  on  medical  ethics,  recognized  that  risk  to  HCPs  is  a  factor  to 
consider  when  determining  whether  confidentiality  should  be  breached.  Current 
regulation  and  policy  suggest  that  military  doctors  will  never  risk  harm,  through  military 
channels,  for  disclosing  information.  On  the  other  hand,  doctors  will  always  be  in  fear 
that  failure  to  disclose  particular  PHI  will  result  in  a  negative  consequence  (i.e.  violence 
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or  suicide)  and  the  HCP  will  be  blamed.  At  the  same  time,  substantial  pressure  can  be 
put  on  doctors  as  commander’s  exercise  their  newly  created  “right  to  know”  through  the 
recently  mandated  “collaborative  communications.”  Soldiers,  meanwhile,  have  little 
practical  recourse  if  information  is  inappropriately  disclosed.  The  only  formal  complaint 
apparatus  is  through  the  Department  of  Health  and  Human  Services.  In  theory,  doctors 
could  face  discipline  from  their  non-military  licensing  authorities.  However,  if  military 
medical  channels  support  military  HCPs,  state  licensing  organizations  are  unlikely  to 
second-guess  the  military  evaluation. 

Military  HCPs  will  feel  constrained  to  disclose  rather  than  “advocate  for  the 
protection  of  confidential  information.”  Military  HCPs  are  unlikely  to  seek  to  change 
aspects  of  the  confidentiality  rules,  even  if  they  are  inconsistent  with  the  best  interests 
of  a  patient. 

Less  Privacy  Undermines  Military  Readiness. 

The  Army’s  strategic  objectives  clearly  state  the  Army’s  purpose:  ... 
sustain  an  all-volunteer  force  composed  of  highly  competent  Soldiers  that 
are  provided  an  equally  high  quality  of  life;  ...  The  means  of  this  strategy 
are  people  more  specifically,  leaders...  These  leaders  represent  the 
means  for  the  Army  to  achieve  its  desired  end.152 

Readiness  is  perhaps  the  most  challenging  area  in  which  to  balance  privacy  and 

disclosure.  On  the  one  hand,  privacy  helps  build  strong  and  healthy  relationships.  On 

the  other  hand,  disclosure  may  be  necessary  for  the  very  safety  of  unit  members.  The 

views  of  both  the  individual  soldier-patient  and  his  fellow  unit  members  must  be 

considered. 

Many  facets  of  a  service  member’s  life  are  exposed  to  peers  and  unit  leaders. 
Further,  many  decisions  that  a  civilian  could  make  freely  are  controlled  in  the  life  of  a 
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service  member.  Few  areas  are  kept  “private.”  Service  members,  however,  have  the 
same  human  needs  to  maintain  dignity  and  personal  autonomy  and  avoid 
embarrassment.  In  the  small  and  often  tight-knit  nature  of  a  military  community,  service 
members  may  be  particularly  sensitized  to  avoiding  the  embarrassment  associated  with 
some  medical  or  mental  health  conditions.  Further,  service  members  clearly  perceive 
that  discrimination  and  economic  harm  may  result  if  certain  conditions  become  well- 
known.  Maintaining  privacy  of  medical  information  contributes  to  a  positive  self-image 
of  soldiers.  A  military  society  that  maintains  medical  privacy  appropriately  is  one  that 
service  members  will  want  to  inhabit.  Therefore,  secondary  effects  of  greater 
confidentiality  protections  would  be  a  better  quality  of  life  for  service  member-patients 
and  higher  retention  of  these  service  members  in  the  military. 

Commanders  and  other  unit  leaders,  on  the  other  hand,  are  charged  with  also 
protecting  the  interests  of  the  peers  and  comrades  of  these  service  member  patients. 
These  fellow  Soldiers,  Sailors,  Marines  and  Airmen  will  take  solace  knowing  that  the 
commander  knows  which  personnel  are  on  medications  that  may  impact  the  mission. 
They  would  be  reassured  to  know  that  the  unit  physician  informed  the  commander  that 
one  of  their  peers  needs  to  be  taken  off  of  a  mission  because  he  may  break  down  due 
to  a  physical  or  behavioral  condition.  Therefore,  the  military  medical  confidentiality 
scheme  should  never  fully  mirror  the  civilian  one. 

Broader  disclosure  undermines  efforts  to  reduce  stigma.  DOD  policy  strives  to 
“[eliminate  barriers  to  and  the  negative  stigma  associated  with  seeking  counseling 
support.”153  The  most  specific  and  immediate  defect  associated  with  the  broad 
disclosure  approach  is  that  it  undercuts  the  effectiveness  of  the  military’s  robust  efforts 
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to  reduce  the  stigma  of  seeking  behavioral  health  services  and  to  address  PTS  and  TBI. 
The  physical  and  mental  health  of  military  personnel  is  a  critical  component  of 
maintaining  both  a  high  quality  of  life  and  top-notch  competence.  Unfortunately,  as  a 
result  of  the  stigma  associated  with  seeking  behavioral  health  services,  many  service 
members  avoid  needed  treatment.  Embarrassment  and  fear  of  negative  career 
repercussions  contribute  to  stigma. 

The  military  has  gone  a  long  way  to  protect  privacy.  Some  recent  efforts  have 
taken  the  command  structure  out  of  the  medical  process.  Both  CATEP  and  Military 
One-Source,  for  example,  allow  soldiers  to  obtain  treatment  outside  of  traditional 
channels.  Broader  disclosure  of  health  information  to  unit  leaders  runs  directly  counter 
to  these  and  other  recent  stigma-reducing  initiatives. 

Broader  disclosure  undermines  trust  between  a  service  member  and  his  leaders. 
Like  the  commander  who  arbitrarily  invades  the  physical  space  of  a  service  member, 
lack  of  medical  confidentiality  risks  eroding  the  professional  trust  relationship  between  a 
service  member  and  his/her  leadership.  Although,  commanders  need  to  stay  informed 
of  serious  medical  or  behavioral  issues  to  accomplish  their  missions  safely  and  to  keep 
faith  with  the  rest  of  the  unit  personnel,  as  discussed  earlier,  honoring  medical  privacy 
demonstrates  that  leaders  respect  service  members’  dignity  and  will  improve 
relationships  and  build  better  units. 

Broader  disclosure  also  undermines  trust  between  the  military  patient  and  his/her 
healthcare  provider  and  puts  doctors  in  an  untenable  ethical  position.  The  broad 
disclosure  rules  and  close  communications  between  HCPs  and  commanders  interfere 
with  the  duty  of  “physicians  to  express  their  loyalty  to  patients.”  The  civilian  HIPAA 
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Privacy  Rule  has  a  separate  section  for  psychotherapy  notes  which  severely  restricts 
disclosure  of  such  information.  The  military  privacy  rules  make  no  distinction  between 
psychotherapy  data  and  other  HCP  information.  In  light  of  the  stress  service  members 
endure,  they  would  greatly  benefit  from  “the  trust  that  is  at  the  core  of  the  patient- 
physician  relationship.”  Reduced  medical  privacy  and  confidentiality  make  this  trust 
relationship  difficult  to  establish  and  maintain.  As  a  result,  some  service  members  will 
be  reluctant  to  seek  care  or  may  withhold  information,  thus  compromising  the  quality  of 
care. 

In  too  many  instances,  the  Army  guidance  transforms  permissive  disclosures  into 
mandatory  ones,  often  requiring  proactive  disclosure.  Very  few  of  the  civilian  world 
exceptions  to  privacy  embodied  in  the  HIPAA  Privacy  Rule  require  disclosure  -  instead 
they  merely  permit  disclosure.  This  allows  medical  professionals  to  exercise  discretion 
in  most  circumstances.  Military  practitioners  have  substantially  lost  this  discretion.  By 
eliminating  medical  discretion,  military  doctors  are  emasculated,  ethically.  The  black 
and  white  approach  removes  decisions  from  being  based  on  medical  judgment  to  being 
rule-driven  or  commander  driven.  Discretion  is  one  of  the  hallmarks  of  a  professional. 
Howe  discusses  how  military  “physicians  must  weigh  choices  and  obligations  to  ensure 
the  best  treatment  possible  for  patients  within  the  context  of  military  interests.”154 
Ceding  medical  discretion  to  regulations  or  to  non-medical  commanders  risks  forcing 
healthcare  providers  to  violate  deeply  held  medical  ethical  norms  dating  back  to  the 
Hippocratic  Oath.  Finally,  the  disclosure-friendly  approach  undermines  the  healthcare 
professional’s  ethical  responsibility  to  provide  minimum  information  and  to  “advocate  for 
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the  protection  of  confidential  information  and,  if  appropriate,  seek  a  change  in  the 
law.”155 

The  discussion  above  does  not  suggest  that  military  medical  privacy  and 
confidentiality  should  replicate  the  civilian  context.  In  circumstances  when  the  military 
environment  is  truly  “specialized,”  for  example  during  combat  or  training  missions  where 
lives  are  at  risk,  medical  personnel  must  err  on  the  side  of  disclosure.  Importantly,  as 
discussed  below,  military  professionals  will  exercise  discretion  in  determining  when 
disclosure  should  occur. 

Recommendations  and  Conclusion 

This  paper  recommends  five  actions  the  Army  should  take  to  embed  a  culture 
that  respects  confidentiality  as  an  important  value.  First,  by  regulation,  the  most 
important  standards  in  HIPAA  should  be  extended  to  commanders  and  other  unit 
leaders.  Currently,  once  commanders  learn  information  from  HCPs,  only  the  Privacy 
Act  restrains  the  subsequent  disclosure  of  medical  information.  The  more  permissive 
Privacy  Act  disclosure  threshold  -  “need  to  know”  -  provides  less  protection  of  sensitive 
medical  or  mental  health  information.  Applying  HIPAA  would  distinguish  medical 
information  from  other  personal  data  pertaining  to  service  members.  This  distinction 
would  have  both  a  direct  and  indirect  impact.  Directly,  the  HIPAA  Privacy  Rule,  as 
implemented  in  DOD  and  Army  regulation  and  guidance,  would  place  additional 
restraints  on  disclosure.  Indirectly,  requiring  leaders  to  adhere  to  the  same  privacy 
code  as  medical  professionals  will  give  leaders  exposure  to  the  culture  of  confidentiality 
and  privacy  embedded  in  the  health  care  profession.  This  change  would,  in  particular, 
limit  further  dissemination  of  PHI  under  the  many  regulatory  provisions  authorizing 
disclosure  for  limited  purposes. 
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Second,  DOD  and  the  Army  need  to  more  narrowly  define  several  of  the  terms 
that  allow  disclosure.  For  example,  “fitness  for  duty”,  “fitness  for  a  particular  mission,” 
and  “to  carry  out  any  other  activity  necessary  to  the  proper  execution  of  the  mission” 
could  be  more  precisely  defined.  Refinements  should  occur  in  two  areas.  Guidance 
should  distinguish  situations  when  lives  are  at  risk,  in  combat  or  in  garrison.  In  those 
instances,  the  disclosure  threshold  should  be  lower  than  circumstances  when  the  risks 
are  not  as  great.  This  distinction  captures  one  important  facet  of  the  unique  military 
environment.  In  addition,  any  new  standard  should  explicitly  balance  the  risk  of  harm 
with  the  likelihood  of  that  harm  occurring.  Military  health  care  providers  should  make 
that  determination.  Uniformed  doctors  will  always  be  cognizant  of  the  unique  military 
context. 

Third,  medical  policy-makers  should  limit  the  communications  between  HCPs 
and  unit  leaders  regarding  individual  soldier  PHI.  Regulations  should  require 
notification  to  service  member  patients  when  doctors  communicate  with  their 
commanders  about  the  service  member’s  medical  or  behavioral  health,  unless  the 
treating  doctor  determines  that  such  notification  would  be  harmful  to  the  patient.  In 
most  instances,  such  notification  to  the  service  member  should  precede  any 
communication  between  HCP  and  leader.  Notifying  patients,  even  if  they  do  not  have 
the  ability  to  stop  the  disclosure,  would  restore  a  measure  of  autonomy  and  self-respect 
to  the  soldier-patient  and  reduce  the  negative  impact  of  such  disclosure  on  the  doctor- 
patient  relationship. 
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Fourth,  all  references  to  a  commander’s  “right  to  know”  should  be  revised  to  read 
“need  to  know.”  Such  a  change  would  better  balance  the  interests  of  individual  service 
member  patients  with  the  interests  of  unit  leaders. 

Fifth,  discretion  for  disclosure  decisions  should  be  returned  to  health  care 
professionals.  Most  disclosures  beyond  those  authorized  in  the  civilian  context  should 
be  made  discretionary.  The  factors  discussed  by  Flowe  would  be  appropriate.  The 
needs  of  the  military  as  a  “separate  society”  would  remain  in  the  forefront  because 
military  doctors,  perhaps  in  collaboration  with  military  attorneys,  would  be  making  the 
disclosure  calculus.  Further,  except  in  cases  of  exigency,  the  “disclosure  authority” 
should  reside  at  least  one  supervisory  level  higher,  in  technical  medical  channels,  than 
the  treating  FICP.  This  would  reduce  pressure  on  junior  FICPs  facing  more  senior 
commanders  and  unit  leaders  and  would  further  inject  a  more  mature  “military” 
perspective  in  the  decision  making  process. 

The  limits  of  medical  privacy  and  confidentiality  are  challenging  areas  in  a 
military  society.  Reasonable  minds  could  certainly  disagree  on  how  to  balance  the 
powerful  interests  and  equities  in  both  directions.  This  paper  concludes  that  DOD,  and 
the  Army  in  particular,  has  moved  too  far  towards  abandoning  meaningful  restraint  on 
disclosure  of  protected  health  information.  Without  betraying  the  unique  aspects  of  the 
military  environment,  recent  changes  to  the  rules  and  policies  should  be  re-visited  to 
better  protect  the  personal  health  information  of  our  Soldiers,  Sailors,  Airmen  and 
Marines.  In  the  long  run,  such  changes  will  best  advance  the  strategic  objective  of 
“sustaining]  an  all-volunteer  force  composed  of  highly  competent  [Service  members] 
that  are  provided  an  equally  high  quality  of  life.”156 
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